obsidian-headless
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the 'obsidian-headless' package via the global npm registry. This is an official utility provided by the vendor.
- [COMMAND_EXECUTION]: The skill utilizes the 'ob' command-line interface to perform various vault operations including synchronization, site publishing, and configuration updates.
- [INDIRECT_PROMPT_INJECTION]: The skill manages Obsidian vaults which contain user-provided Markdown content, representing a potential surface for indirect instructions.
- Ingestion points: Markdown files and vault metadata located in the target vault directory.
- Boundary markers: None explicitly defined for note content.
- Capability inventory: CLI commands for network synchronization ('ob sync'), site publishing ('ob publish'), and account management ('ob login').
- Sanitization: The tool synchronizes vault data as provided by the filesystem without intermediate sanitization steps.
Audit Metadata